论文标题
RSSD：使用硬件分配的网络存储代码和攻击后分析防御勒索软件
RSSD: Defend against Ransomware with Hardware-Isolated Network-Storage Codesign and Post-Attack Analysis
论文作者
论文摘要
加密勒索软件已成为臭名昭著的恶意软件。它将在固态驱动器（SSD）等存储设备（例如SSD）等存储设备上加密用户数据，并要求赎金以还原用户的数据。为了绕过现有的防御，勒索软件将不断发展并执行新的攻击模型。例如，我们识别并验证了三项新攻击，包括（1）垃圾收集（GC）攻击，该攻击利用了存储容量并保持数据以触发GC并迫使SSD释放保留数据； （2）有意减慢加密数据的步伐并隐藏其I/O模式以逃避现有防御的速度； （3）利用SSD中可用的Trim命令进行物理擦除数据的修剪攻击。 为了增强SSD对这些攻击的鲁棒性，我们建议RSSD（勒索软件意识SSD）。它重新设计了SSD的Flash Management，以启用硬件辅助日志记录，该记录可以保守地保留旧版本的用户数据，并按时收到的存储操作以低开销的开销。它还在以太网上采用了硬件分离的NVME来扩展本地存储容量，以透明地将日志以安全的方式将日志卸载到远程云/服务器。 RSSD通过构建可信赖的存储操作的证据链来帮助调查勒索软件攻击，从而实现攻击后分析。我们使用现实世界的SSD FPGA板开发RSSD。我们的评估表明，RSSD可以防御新的和未来的勒索软件攻击，同时引入可忽略不计的性能开销。
Encryption ransomware has become a notorious malware. It encrypts user data on storage devices like solid-state drives (SSDs) and demands a ransom to restore data for users. To bypass existing defenses, ransomware would keep evolving and performing new attack models. For instance, we identify and validate three new attacks, including (1) garbage-collection (GC) attack that exploits storage capacity and keeps writing data to trigger GC and force SSDs to release the retained data; (2) timing attack that intentionally slows down the pace of encrypting data and hides its I/O patterns to escape existing defense; (3) trimming attack that utilizes the trim command available in SSDs to physically erase data. To enhance the robustness of SSDs against these attacks, we propose RSSD, a ransomware-aware SSD. It redesigns the flash management of SSDs for enabling the hardware-assisted logging, which can conservatively retain older versions of user data and received storage operations in time order with low overhead. It also employs hardware-isolated NVMe over Ethernet to expand local storage capacity by transparently offloading the logs to remote cloud/servers in a secure manner. RSSD enables post-attack analysis by building a trusted evidence chain of storage operations to assist the investigation of ransomware attacks. We develop RSSD with a real-world SSD FPGA board. Our evaluation shows that RSSD can defend against new and future ransomware attacks, while introducing negligible performance overhead.
